Use case

Automatically submit requests to extend end date for contractors and have a manager to approve them.

Issue

All requests made using built-in function evaluator activity will bypass AuthZ stage and approval will not happen.

Solution

Using the same technique described for AD account and mailbox approval in scenario [How to approve new AD accounts and mailboxes before they are created when requests are coming from HR] (https://github.com/Microsoft/MIMWAL/wiki/New-Accounts-Approval) you can submit requests to extend end date for contractors

Key points:

Create a set !users expiring in 1 month with users who have expiration date after today and before 31 days from today.

This is needed to prevent requests be submitted for users resigned long time ago.

Create a transition IN policy !AD: make request to extend an account and a workflow !AD: submit request to extend contractor's end date.

The only one step in workflow will be Update Resource activity.

In addition you need to create a standard Approval policy to obtain the manager's approval. Create the Approval Workflow !AD: approve account end date extension and MPR !AD: approve requests from FIM Agent - account extension.

Mind the step prior to approval activity. It changes request name from 'Update to person...' to 'Extend AD account expiration date for John Doe'. To do so you set the [//Request/DisplayName] to be "Extend AD account expiration date for " + [//Target/DisplayName]